Chapter 10: Configuring and Managing Users in Azure Active Directory (Azure AD)

Azure Active Directory (Azure AD or AAD) provides additional functionality and granularity when it comes to managing users, access restrictions, groups, and licensing. It is included by default at the heart of O365 identity and security. We will look at some of the more popular reasons as to why O365 administrators might find themselves in Azure AD.

This chapter includes the following recipes:

• Bulk create users in AAD
• Adding branding to the AAD sign-in page
• Adding a privacy statement to the AAD sign-in page
• Installing and connecting to AAD via PowerShell
• Adding/removing users via PowerShell in AAD
• Creating an access review report in Azure AD
• Allowing/disallowing users from connecting LinkedIn to their account
• Enabling a self-service password reset
• Using SSO to simplify organization-wide sign-in processes

Technical requirements

This chapter will often require that you're a global administrator in your tenant although, in certain cases, a user administrator role will suffice. You'll also need to be able to run PowerShell and may need rights to install software on a machine in order to complete all the recipes.

Bulk create users in AAD

When adding multiple users to Azure AD, it is often more efficient to do so in batches. In this recipe, we'll bulk create users in Azure AD.

Getting ready

You should be a global or user administrator to complete this recipe.

How to do it…

1. Go to https://aad.portal.azure.com/. Sign in if prompted.
2. Click Users from the left-hand navigation menu.
3. From Bulk activities, select Bulk create:

   Figure 10.1 – Bulk create option available from the Users blade of Azure Active Directory

4. Click Download to download the CSV template to use for properly formatting the soon-to-be-imported users.
5. Open the template and paste or complete rows for each user to be imported, filling in the following column values:

   --Name [displayName] Required

   --User name [userPrincipalName] Required

   --Initial password [passwordProfile] Required

   --Block sign in (Yes/No) [accountEnabled] Required

   --First name [givenName]

   --Last name [surname]

   --Job title [jobTitle...

Adding branding to the AAD sign-in page

Adding your own branding to the AAD sign-in page lets your users easily confirm that they're signing into the correct tenant by recognizing familiar graphics. It also gives your organization a more polished, professional appearance, not only to your own users, but also to your guest users signing into your tenant. In this recipe, we'll add branding elements to the AAD sign-in page.

Getting ready

You must be a global administrator to complete the steps in this recipe. You'll also need images ready that match the following specifications (with transparent backgrounds in most cases where appropriate):

• Background: 1920 x 1080 px | <300 KB | PNG, JPG, or JPEG
• Banner: 280 x 60 px | 10 KB | PNG, JPG, or JPEG
• Square: 240 x 240 px | 50 KB | PNG (preferred), JPG, or JPEG
• Square – Dark: 240 x 240 px | 50 KB | PNG (preferred), JPG, or JPEG

How to do it…

1. Go to the Azure Active Directory...

Adding a privacy statement to the AAD sign-in page

When users view their O365 account (settings wheel > View account), there's a link for Security & privacy that they can click. There, they'll find a link to Organization Privacy Statement, which we'll configure in this recipe:

Figure 10.11 – Organization Privacy Statement link in a user's O365 account settings

Getting ready

You must be a global administrator to complete the steps in this recipe.

How to do it…

1. Go to the Azure Active Directory Admin Center at https://aad.portal.azure.com.
2. Select Azure Active Directory from the left navigation menu.
3. Click Properties from under the Manage heading.
4. Find the field for your Privacy statement URL and add it:

   Figure 10.12 – Privacy statement URL configuration field in AAD properties

5. Click Save (at the top).

How it works…

In this recipe, you've updated your organization...

Installing and connecting to AAD via PowerShell

Azure AD can be managed easily using PowerShell cmdlets, in the same way as we've demonstrated with general O365 administration via PowerShell in Chapter 3, Administering Office 365 with PowerShell. Remember to run PowerShell as an administrator (right-click, and then choose Run as administrator) when running commands to ensure you'll be able to complete actions (assuming your credentials are also valid for the action you're attempting to perform). In this recipe, we'll install and connect to AAD via PowerShell to unlock many more administrative capabilities.

Getting ready

You must be a global administrator to complete the steps in this recipe.

If you haven't done so already (perhaps in Chapter 3, Administering Office 365 with PowerShell), download and install the Microsoft Online Services Sign-In Assistant at http://go.microsoft.com/fwlink/?LinkID=286152.

How to do it…

1. Install either...

Adding/removing users via PowerShell in AAD

This recipe should begin to get you thinking about how you could potentially automate regular processes in your organization by utilizing PowerShell as part of your automated job. While we'll manually add a user to Azure AD in this recipe, you could have the same PowerShell script run based on a trigger from your HR system, by way of an example. For now, we'll start with the basics – running the script itself manually to add a user.

Getting ready

You must be a global administrator to complete the steps in this recipe.

How to do it…

1. Open Windows PowerShell (or your PowerShell client of choice) as the administrator.
2. Connect to Azure AD using Connect-AzureAD.
3. Use a script such as the following, replacing the user's specific info where appropriate.

   $PasswordProfile = New-Object -TypeName Microsoft.Open.AzureAD.Model.PasswordProfile
   $PasswordProfile.Password = "aBc123!ndc"
   New-AzureADUser...

Creating an access review report in Azure AD

Access reviews allow you to easily review who has access to which apps and groups on a regular basis. You could recertify memberships routinely, manage guests, and increase governance efficiency by making access privileges more visible to those needing that information. In this recipe, we'll onboard to begin using access reviews and then create a report.

Getting ready

You must be a global or user administrator to complete the steps in this recipe, and need either an Azure AD Premium P2 subscription or an Enterprise Mobility + Security E5 subscription to use this feature.

How to do it…

1. Go to the Azure Active Directory Admin Center at https://aad.portal.azure.com.
2. Click on Azure Active Directory from the left navigation menu and then choose Identity Governance.
3. If this is your first time creating an access review, click Onboard on the left-hand navigation pane. Otherwise, skip to step 7:

   


   Figure...

Allowing/disallowing users from connecting LinkedIn to their account

By default, users may be able to connect their LinkedIn accounts to their work or school account in your organization. This allows ease of access to LinkedIn data for their colleagues and provides a pre-built social network for your organization to utilize. You can manage whether this is a possibility via Azure AD. In this recipe, we'll disable the ability to connect to LinkedIn.

Getting ready

You must be a global administrator to complete the steps in this recipe.

How to do it…

1. Go to the Azure Active Directory Admin Center at https://aad.portal.azure.com.
2. Click on Azure Active Directory from the left navigation menu and then choose User settings:

   Figure 10.26 – User settings link in the left-hand navigation menu of AAD

3. Change LinkedIn account connections to No:

   Figure 10.27 – Example showing LinkedIn account connections disabled

4. Click Save.

How it works...

Enabling a self-service password reset

Allowing your users to handle their own password resets saves administrative time for IT staff and empowers your users to make better decisions when it comes to their digital identities and security. If it's easier for users to reset their own password, chances are they're more likely to when they suspect potential credential leakage or exposure. It also means that when users are working late, they can reset their own forgotten password at any time instead of waiting for the resolution of a support ticket that might be hours away.

In this recipe, we'll enable self-service password reset via Azure Active Directory.

Getting ready

You must be a global administrator to complete the steps in this recipe.

How to do it…

1. Go to the Azure Active Directory Admin Center at https://aad.portal.azure.com.
2. Click on Azure Active Directory from the left navigation menu and then choose Password reset.
3. Click either...

Using SSO to simplify organization-wide sign-in processes

If your organization uses applications and services beyond Microsoft 365, chances are you have multiple sign-in processes. However, you can utilize single sign-on (SSO) to simplify these multiple sign-in processes by using your O365 credentials to provide authentication vis-à-vis third-party applications.

SSO is a massive topic. In this recipe, we'll share the steps necessary to review the available options and ideas to help you choose the best method to suit your needs.

Getting ready

You must be a global administrator to implement an SSO method, and will need to be an administrator of any third-party apps to which you'll be configuring a connection.

How to do it…

1. Use the flowchart at https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-single-sign-on#choosing-a-single-sign-on-method to help you choose an appropriate single-sign on method.
2. Review integration...